The vulnerability arises because the User Center login integration fails to attach an external identity to a session created for an external user whose central account is suspended or deleted. As a result, subsequent requests from that session bypass the normal checks that would otherwise block access, allowing the suspended user to perform authenticated actions until the session expires or is revoked. This grants an attacker unauthorized use of the system.

Apache Answer versions up to and including 2.0.2 are affected. The product is Apache Answer from the Apache Software Foundation, and the issue is fixed in version 2.0.3 and later.

The EPSS score is < 1% and the CVSS score is 5.4, indicating moderate severity. The vulnerability is not listed in CISA KEV, indicating no known widespread exploitation. Based on the description, it is inferred that an attacker who initiates a login for a suspended or deleted account can maintain a session and gain unauthorized access until the session expires or is revoked. The flaw operates within the authentication flow, so the risk is moderate in the absence of a public exploit, but the impact could be significant if exploited.